Skip to main content

Looking for Valuant? You are in the right place!

Valuant is now Abrigo, giving you a single source to Manage Risk and Drive Growth

Make yourself at home – we hope you enjoy your new web experience.

Looking for DiCOM? You are in the right place!

DiCOM Software is now part of Abrigo, giving you a single source to Manage Risk and Drive Growth. Make yourself at home – we hope you enjoy your new web experience.

How to create a sound credit risk rating system

Rob Newberry
Kent Kirby
Mary Ellen Biery
December 8, 2023
Read Time: 0 min

Develop a risk grading system that helps manage lending risk. 

Financial institutions need a repeatable, consistent, process for accurately scoring credit risk. Here are some recommended approaches for internal risk rating systems.

You might also like this webinar, "Unraveling risk rating: Making sense of your best early warning tool."



The basics of rating and monitoring credit risk

Banks and credit unions often use a standardized risk rating system for internal monitoring of credit risk. Regulators stress the importance of accurate and timely risk ratings, especially during economic uncertainty. Financial institutions should anticipate that credit rating systems and loan grading will receive enhanced emphasis during upcoming exams.

This article outlines the significance of credit risk ratings and regulatory priorities related to credit grading. It also offers guidance for assessing and monitoring credit risks while meeting risk management and compliance goals.

Align risk with goals

Why a solid credit risk grading system matters

Credit risk grading systems play a crucial role in aligning loan originations with a financial institution’s risk tolerance and strategic goals. Internal risk scoring often determines credit approval processes, covenants placed on the borrower, and loan pricing for commercial loans.

Moreover, loan risk grading systems form the basis for broader risk management practices – including setting the reserve, stress testing the loan portfolio, setting risk appetites, and strategic planning. Effective credit risk ratings help financial institutions understand the migration of risk through the portfolio so they can act strategically to address potential problems before they become actual ones. 

“A good loan grading system is a great way to have an early warning system that helps the board and management oversee the entire loan portfolio,” according to Abrigo Senior Consultant Rob Newberry. He and Director of Advisory Services Kent Kirby recently covered risk rating in the webinar “Unraveling risk rating: Making sense of your best early warning tool.”

Which credit areas need routine "maintenance"? Get ready for the next credit cycle with credit department housekeeping tips from this webinar.

keep me informed watch

Systems will vary

Regulatory emphasis on loan risk rating scales

Banking regulators expect financial institutions to manage credit risk using systems that are able to distinguish between different buckets of risk in the portfolio. In a recently updated “Supervisory Insights,” FDIC staff noted the far-reaching implications of grading processes, from approving credits to maintaining adequate capital. Accurate and timely ratings form the foundation for effective credit risk review, according to interagency guidance.

The methodologies that banks or credit unions use for grading loans and assigning credit risk ratings or credit risk scores vary across institutions. Both internally built and vendor-supplied solutions are useful if effectively designed and executed.  The OCC’s Comptroller’s Handbook on “Rating Credit Risk” says that “a bank’s risk rating system should reflect the complexity of its lending activities and the overall level of risk involved. No single credit risk rating system is ideal for every bank.”

The NCUA’s examiner guide, too, says rating systems will vary among credit unions. “Each institution must determine if unique risk factors require different systems for different loan types and industries. In some cases, a credit union with a complex and diverse portfolio may need to use multiple risk-rating systems to accurately rate the level of risk.”

What risk rating should include

Expectations for credit rating processes

While regulators don’t prescribe a specific process for credit risk rating systems, the OCC outlines its expectations for them. These include:

  • Integration into the bank’s overall portfolio risk management.
  • Board approval and assignment of accountability for the risk rating process.
  • Timely and accurate ratings for all credit exposures, including a composite rating for the repayment capacity and loss potential of a portfolio of loans if those credits don't receive individual ratings.
  • An adequate number of ratings.
  • Clear and precisely defined criteria using objective and subjective factors for assigning each rating.
  • Ratings that reflect risks posed by the borrower’s expected performance and the transaction’s structure.
  • Dynamic risk rating systems (i.e., ratings should change when risk changes).
  • Back-tested and independently validated.
  • Ratings that are well supported and documented in the credit file.

Four regulatory ratings required for credits

Even with flexibility to customize risk rating systems and the number of ratings used, every bank or credit union’s rating scale must include four rating categories required by guidance to identify problem credits. The criticized loan categories and their definitions are:

  • Special mention – The loan has a potential weakness that could lead to future credit deterioration without appropriate monitoring.
  • Substandard – The loan has an identified weakness that will likely lead to loss without appropriate action.
  • Doubtful – The loan has an identified weakness(es) that make full repayment highly questionable and improbable. Loans in this category are placed on nonaccrual status.
  • Loss – The loan is uncollectible, usually because the borrower has declared bankruptcy, discontinued payments, or closed the business.

Credits not covered by the four regulatory ratings are considered “pass” credits, and no formal regulatory definition exists for distinguishing among pass credits.

Newberry participated with examiners in a recent industry conference panel on credit risk, and he recalled examiners conveying that a key concern is proper identification of regulatory classified loans, especially those categorized as substandard, doubtful, or loss. 

This emphasis on properly classified loans makes it vital to thoughtfully set up risk rating categories.

How do you catch troubled loans?
Learn more in this webinar, "Problem loans: Identifying warning signs and management options."

WATCH Keep me informed

Granularity is essential

How many risk ratings should an institution use?

While many institutions use a nine-grade system, five to ten ratings are acceptable. “If you get over ten, you kind of lose momentum on the meaning of those,” Newberry said.

Having granularity within pass grades is essential. Variations and the migration between ratings help financial institutions identify loan risk for stress testing and calculating the allowance. “The whole intent is to distribute your pass credits as well as your special mention and classified credits,” Newberry said. “It helps you understand the risk in your portfolio.”

Kirby said granularity, especially at the low end of pass grades, can help institutions develop strategies to avoid holding on to deteriorating loans too long. 

Does any single risk rating grade represent 20% to 25% of the portfolio? More granularity in pass grades may be warranted.

As a rule of thumb, if any single risk rating grade represents 20% to 25% or more of a bank or credit union’s portfolio, there is probably not enough granularity to the risk rating scale. Exploring adding more ratings to split up that concentration is warranted. 


Effective credit rating systems also ensure loans don’t remain indefinitely at the lowest end of pass or in special mention.  An Abrigo survey during the webinar found that 39% of institutions use the special mention category as a transitory classification of less than six months. However, 30% said special mention can be a long-term rating.

Loans in the low pass categories require additional work, especially during annual reviews. “When you start getting down into the low pass categories, you need to start having some hard conversations,” Kirby said. “It gets tough because some of these borrowers are longtime customers, and they’ve been good supporters of the bank. But your job is to support the bank. It’s not to take a hit just because you like somebody.”

5 C's of credit

Best practices: Developing scorecards

Risk rating systems typically use a scorecard, which incorporates several characteristics of the credit and borrower and converts those into a numerical rating of potential future payment volatility.

Many banks and credit unions use the traditional 5 C’s of credit to develop a scorecard:

  1. Capacity. Capacity assesses the borrower’s ability to repay the loan by comparing expected income to the recurring debt for which the borrower will be responsible. Credit analysis often uses debt service coverage and debt-to-income ratios to evaluate capacity.
  2. Collateral. Collateral is often evaluated using loan-to-value and committed loan-to-value ratios. It should provide assurance that if the borrower defaults, the lender will have the opportunity to recoup potential losses.
  3. Conditions. Assessing the conditions of the credit traditionally involves evaluating the terms of the loan (principal balance, payment terms, interest rate) to ensure the financial institution is getting paid for the risk it is assuming with the credit.
  4. Character. Traditionally, character refers to the borrower’s track record of repaying debt, so credit reports and FICO scores are common factors incorporated.
  5. Capital. Evaluating capital during credit analysis typically includes considering the down payment or any other amount the borrower has put toward the investment that requires the loan.

One key element of a scorecard is that it IS a scorecard. It is a form of measurement (in this case, gradations of risk). To achieve a final score, one or more models may (or may not) be employed, depending on the complexity of the portfolio, to arrive at results for the various components of measurement. However, the scorecard itself is not a model. Therefore, an effectively designed scorecard is not necessarily subject to the rigors of model validation.


Updating the traditional 5 C’s of credit

Borrower behavior and the lending environment have changed dramatically in recent years, especially since COVID. As a result, Newberry recommends providing additional focus on two other areas during credit rating:

Concentrations. Concentrated risks in a business – whether related to customers, supply chains, or other factors – resulted in increased credit risk during the pandemic when those risks affected businesses’ ability to generate cash.

Cash. More borrowers have walked away from underwater assets in recent years. Look beyond down payments and consider the borrower’s ability to repay from a cash flow perspective. “What kind of debt load do they carry?  Do they have enough current assets and cash to cover their current liabilities?” said Newberry. “How has the pandemic impacted income or cash flows? Is the borrower in an industry that is more at risk due to expected lags in economic recovery time?”


Creating an objective and subjective risk rating system

Regardless of whether it uses the traditional C’s or a revised list, an institution should incorporate three types of analysis into its loan grading:

  • objective
  • comparative
  • subjective

Objective credit risk rating analysis assesses financial health and involves:

  1. Getting financial statements on an annual basis
  2. Conducting financial ratio analysis
  3. Comparing the borrower to an industry benchmark or standard industry data.

Objective components for grading credit promote consistency in ratings across the lending staff. Quantitative inputs can provide objectivity. Global cash flow, global debt service coverage, global debt to equity, financial statement strength and loan to value, and collateral value for the loan are among ratios commonly analyzed. Future performance after the credit is approved is important to evaluate, too, so Kirby advised including those projections the rating framework as well.  For example, a company may be a 4 rated credit prior to acquiring another company, but after taking on the debt to affect the transaction, the rating will decline to a 6.  The correct rating at the time of underwriting (before funds are disbursed) is 6, not 4.   Don’t wait until the transaction transpires; recognize the risk that the bank is taking.

Industry comparisons can reveal strengths and weaknesses of the specific credit. For example, a dental practice could buck negative trends in the industry because it is the best-run practice in the market. Industry data can also uncover differences between industries to help evaluate a borrower in an industry not already served by the institution. Logging and dairy farming, for example, require a lot of cash and investment upfront, while other types of businesses may not.

Subjective risk-evaluation components

Some aspects of evaluating creditworthiness (such as management strength and strength of guarantors) are more subjective or qualitative. Having significant qualitative risk weightings included in a risk grade adds complexity.

“One issue is that you lose consistency across your lending team,” Newberry said. “Two people should have the exact same number coming off the scorecard.” Subjective components increase the chances that one lender presenting a borrower to the loan committee could get the loan approved but another lender might not. “That’s where examiners have issues,” he added.

Subjective factors also complicate how to change the grade following changes in debt service coverage ratio or net income.  “That impacts downstream capabilities, such as loan migration and stress testing,” Newberry said. “And that issue moves down the line into total losses, impact on net income, and impact on capital.”

He said examiners had emphasized being able to stress test debt service and changes in collateral valuations, so objective analysis is critical.

Subjective credit risk rating systems aren’t an early warning system,” Kirby said. “They’re just not. You have to have an objective base framework in order to have that early warning system.”

And regardless of the regulatory environment, “having an early warning system is important from a good management standpoint,” he said.

This post is an update to an article published in 2022.

About the Authors

Rob Newberry

Senior Consultant
Rob Newberry is Senior Consultant with Abrigo’s Advisory Services and a faculty member of the Graduate School of Banking at the University of Wisconsin-Madison. In the past 10 years, he has worked with financial institution leaders and regulators to develop a suite of credit administration tools for community banks and

Full Bio

Kent Kirby

Director, Advisory Services
Kent Kirby is a retired banker with 39 years of experience in all aspects of commercial banking: lending, loan review, back-room operations, portfolio management, portfolio analytics and credit policy.  As Director, Kirby assists institutions in the creation, review and/or enhancement of current credit policies, risk rating systems and loan review

Full Bio

Mary Ellen Biery

Senior Strategist & Content Manager
Mary Ellen Biery is Senior Strategist & Content Manager at Abrigo, where she works with advisors and other experts to develop whitepapers, original research, and other resources that help financial institutions drive growth and manage risk. A former equities reporter for Dow Jones Newswires whose work has been published in

Full Bio

About Abrigo

Abrigo enables U.S. financial institutions to support their communities through technology that fights financial crime, grows loans and deposits, and optimizes risk. Abrigo's platform centralizes the institution's data, creates a digital user experience, ensures compliance, and delivers efficiency for scale and profitable growth.

Make Big Things Happen.